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U.S. Atlantic Command Year 2000 Issues 


Executive Summary 


Introduction. This is one in a series of reports being issued by the Inspector General, 
DoD, in accordance with an informal partnership widi the Chief Information Officer, DoD, 
to monitor DoD efforts to address the year 20(X) computing challenge. For a listing of 
audit projects addressing the issue, see the year 2000 webpage on I^et at 
<http://www.ignet.gov>. 

Information technology systems have typically used two digits to represent the year, such 
as “98” representing 1998, to conserve electronic storage and reduce operating costs. 

With the two-di^t format, however, the year 2000 is indistinguishable from 1900. As a 
result of the ambiguity, computers and associated systems and application programs that 
use dates to calculate, compare, and sort could generate incorrect results when working 
with years after 1999. 

Audit Objectives. The overall audit objective was to evaluate the status of the U.S. 
Atlantic Command’s progress in resolving the year 2000 computing issues. Our audit 
focused on the following year 2000 issues: leadership support and awareness, management 
and resolution strategy, system assessments, prioritization, system interfaces, testing, risk 
analysis and contingency planning, and support received from responsible Service 
executive agents. 

Audit Results. The U.S. Atlantic Command has taken action to increase year 2000 
awareness throughout the command. However, the U.S. Atlantic Command needs to do 
more. Unless the U.S. Atlantic Command, the Joint Staff, the Services, and Defense 
agencies coUaboratively make further projgress, the U.S. Atlantic Command may not be 
able to ensure that operational capability is not adversely affected by year 2000 problems. 
See Part I for details of the audit results. 

Summary of Recommendations. We recommend that the Commander in Chief, 

U.S. Atlantic Command, establish procedures and timeframes for monitoring and tracking 
the status of mission-critical systems, join with other unified commands to obtain the 
status of mission-critical systems, and report the status of mission-critical supporting 
systems to the year 2000 program office; complete the reconciliation of the 
managed-systems inventory and define reportable systems and how they should be 
categorized; complete compliance edification checklists; establish offices of primary 
responsibili^ for nonstandard commercial off-the-shelf products and reconcile compliance 



discrepancies; develop system and operational contingency plans; and use selected 
command and joint exercises to test year 2000 scenarios and contingency plans in an 
operational environment. 

Management Comments. The U.S. Atlantic Command concurred witii and has taken 
action on all of the recommendations except the recommendation to join with functional 
counterparts at other unified commands to obtain status information of mission-critical 
systems fi’om the Services and Defense agencies. The U.S. Atlantic Command stated that 
the executive agents would be inundated with duplicate requests, and suggested a more 
efficient approach would be for the Joint Staff to obtain the status information and provide 
it simultaneously to the unified commands. The Joint Staff stated that it endorsed the 
recommendations of the report but agreed with the concerns expressed by the U.S. 

Atlantic Command. See Part I for a summary of management comments and Part HI for 
the complete text of the comments. 

Audit Response. Management comments were responsive. We commrad ACOM for 
expediting the necess^ actions to address the recommendations of the report. We did 
not intend that the unified commands duplicate efforts to obtain the status of 
mission-critical systems fi'om the Services and Defense agencies. Rather, the intent of the 
recommendation was to encourage a unified command-wide involvement fi'om a 
functional perspective in DoD year 2000 remediation and continuity of operations efforts. 
For example, an outcome of the year 2000 conference of the unified commands was the 
scheduling of the Operations directorate year 2000 conference to be held in 
September 1998 to collectively discuss continuity of operations issues. Otiier functional 
directorates of the unified commands may have to also proactively and collectively work 
together to obtain and share system information to support year 2000 remediation and 
continuity of operations efforts. We agree, however, that the Joint Staff plays a central 
coordinating role. We will continue working with the Joint Staff, unified commands, DoD 
Year 2000 Program Office, and other DoD components to improve the information flow 
on system year 2000 status to the warfighting community. 


ii 
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Part I - Audit Results 


Audit Background 


The year 2000 (Y2K) problem is the term most often used to describe the potential 
failure of information technology systems to process or perform date-related 
functions before, on, or after the turn of the century. The Y2K problem is rooted 
in the way that automated information systems record and compute dates. For the 
past several decades, systems have typically used two digits to represent the year, 
such as “98” representing 1998, to conserve on electronic data storage and to 
reduce operating costs. With the two-digit format, however, 2000 is 
indistinguishable fi-om 1900. a result of the ambiguity, computers and 
associated system and application programs that use dates to c^culate, compare, 
or sort could generate incorrect results when working with years following 1999. 
Calculation of Y2K dates is further complicated because the Y2K is a leap year, 
the first century leap year since 1600. The computer systems and applications 
must recognize February 29,2000, as a valid date. 

Because of the potential fttilure of computers to run or function throughout the 
Government, the President issued an Executive Order, “Year 2000 Conversion,” 
February 4, 1998, making it policy that Federal agencies ensure that no critical 
Federal program experiences disruption because of the Y2K problem. The 
Executive Order also requires that the head of each agency ensure that efforts to 
address the Y2K problem receive the highest priority attention in the agency. 

DoD Y2K Management Strategy. In his role as the DoD Chief Information 
Officer, the Assistant Secretary of Defense (Command, Control, Communications, 
and Intelligence) issued the “DoD Year 2000 Management Plan” (DoD 
Management Plan) in April 1997. The DoD Management Plan provides the overall 
DoD strategy and guidance for inventorying, prioritizing, fixing, or retiring 
systems, and for monitoring progress. The DoD Management Plan states that the 
DoD Chief Information Officer has overall responsibility for overseeing the DoD 
solution to the Y2K problem. Also, the DoD Management Plan maJces the DoD 
Components responsible for the five-phase Y2K management process. The DoD 
Management Plan includes a description of the five-phase Y2K management 
process. The DoD Management Plan, “For Signature Draft Version 2.0,” 

June 1998, accelerates the target completion dates for the renovation, v^dation, 
and mplementation phases. The new target completion date for implementation of 
mis^on-ciitical systems is December 31, 1998. 

In a memorandum dated January 20, 1998, for the heads of executive departments 
and agencies, the Office of Management and Budget established a new target date 
of March 1999 for implementing corrective actions to all systems. The new target 
completion dates are September 1998 for the Renovation phase and January 1999 
for the Validation phase. 

The Joint Chiefs of Staff. The Chairman of the Joint Chiefs of Staff is the 
principal militaiy advisor to the President, the Secretary of Defense, and ffie 
National Security Council. The Joint Chiefs of Staff have no executive authority 
to command the combatant forces. The Secretaries of the Military Departments 
assign all forces under their jurisdiction to the unified commands to perform 
missions assigned to those commands. 
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The Joint Staff. The Joint Staff Director, Command, Control, 
Communications, and Computer Systems (J6), has been designated by the 
Chairman of the Joint Chiefs of Staff to oversee the unified commands’ and Joint 
Staffs implementation of the DoD Management Plan. 

The Joint Staff assists the Chairman of the Joint Chiefs of Staff with unified 
strategic direction of the combatant forces; unified operation of the combatant 
commands; and integration into an efficient team of land, naval, and air forces. 

Year 2000 Action Plan. The Joint Chiefs of Staff Year 2000 Action Plan, 
March 1998, provides the unified commands and Joint Staff directorates the 
corporate strategy and management approach for addressing the Y2K problem. 
The action plan uses the accelerated target completion dates for the renovation, 
validation, and implementation phases in the dr^ DoD Management Plan. The 
action plan provides that the unified commands should target December 31, 1998, 
for completion of all Y2K efforts. 

U.S. Atlantic Command. The U.S. Atlantic Command (ACOM) is one of nine 
unified commands in the Department of Defense. The ACOM was established on 
October 1, 1993. The ACOM is responsible for conducting joint operations, 
humanitarian assistance, counterdrug operations, and military support for civilian 
authoiities within its area of responsibility. The ACOM area of responsibility 
encompasses 45 million square mUes of Atlantic Ocean fi'om the North Pole to the 
South Pole and fi'om the east coast of the United States to Gibraltar, including the 
Norwegian, Greenland, and Barents seas. It also includes the Pacific Ocean west 
of Central and South America and the continental United States. The ACOM 
reports to the Secretary of Defense. The overall mission of ACOM is to support 
and advance U.S. interests and policies throughout its assigned area of 
responsibility and to accomplish the following: 

• provide combat-ready land, maritime, and air forces to U.S. warfighting 
commanders in chief; 

• conduct operations unilaterally or in concert with coalition partners; and 

• train forces as joint units. 

The ACOM is supported by component commands fi'om each Service that provide 
forces as required to conduct operations. The component commands are the U.S. 
Army Forces Command; the U.S. Navy Atlantic Fleet; the U.S. Air Force Air 
Combat Command; and the U.S. Marine Forces, Atlantic. 
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Audit Objectives 


The overall audit objective was to evaluate the status of the progress of ACOM in 
resolving its Y2K computing issues. Our audit focused on the following Y2K 
issues: leaderslup support and awareness, management and resolution strategy, 
system assessments, prioritization, system interfaces, testing, risk ^alysis and 
contingency planning, and support received from responsible Service executive 
agents. We did not review the management control program related to the overall 
audit objective because DoD recognizes the Y2K issue as a material management 
control weakness area in the FY 1997 Annual Statement of Assurance. See 
Appendix A for a discussion of the audit scope and methodology and Appendbc B 
for a summary of prior audit coverage. 
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Status of the U.S. Atlantic Command 
Year 2000 Program 

The ACOM has taken action to increase Y2K awareness throughout the 
command. The ACOM needs to do more in the following areas; 

• gaining visibility over its mission-critical systems owned by the 
Services and Defense agencies; 

• reconciling its managed-systems inventory to reflect the actual 
number and status of ACOM systems; 

• preparing compliance checklists and certifying ACOM-managed 
systems as compliant; 

• establishing directorate responsibility for all of its commercial 
off-the-shelf products; 

• developing system and operational contingency plans to establish 
alternate procedures to accomplish the mission; and 

• using selected command and joint exercises to test Y2K 
scenarios and contingency plans in an operational environment when 
possible. 

Unless ACOM, the Joint Staff, the Services, and Defense agencies 
collaboratively make further progress, ACOM and the other unified 
commands will be unable to ensure that operational capability is not 
adversely affected by Y2K problems. 


Y2K Program Management 


The ACOM has taken action to increase Y2K awareness throughout the 
command. 

Y2K Program OfHce. The ACOM Director of Command, Control, 
Communications, and Computer Systems (J-6) is the Y2K program office and has 
responsibility for the ACOM Y2K Program. The ACOM Director of Command, 
Control, Communications, and Computer Systems reports the status of ACOM 
directly to the Commander in Chief and Deputy Commander in Chief On 
April 7,1998, the ACOM Director of Command, Control, Communications, and 
Computer Systems briefed the Deputy Commander in Chief and all of the ACOM 
directors on the Y2K responsibilities of each ACOM directorate. 

The Command, Control, Communications, and Computer Systems directorate 
Y2K program office; 

• created and maintains an ACOM Y2K web page; 

• reconciles the ACOM systems inventory; 
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Status of the U.S. Atlantic Command Year 2000 Program 


• prepares the quarterly reports submitted to the Joint Staff; 

• developed the ACOM Y2K Management Plan; and 

• chairs regular meetings with directorate Y2K representatives. 

Additionally, the Conunand, Control, Communications, and Computer Systems 
directorate Y2K program office has taken the responsibility for identifying the 
status of systems that the Services and Defense agencies owned and that all of 
ACOM used. 

ACOM Directorates. The Command, Control, Communications, and Computer 
Systems directorate Y2K program office is responsible for all ACOM Local 
Information System network-centered hardware and software. However, the 
ACOM directorates are responsible for all non-Local Information System network 
hardware and software and also nonstandard software that resides on the ACOM 
local network. Additionally, the directorates are responsible for the following: 

• coordinating with the Joint Staff functional counterparts to obtain 
mission-critical systems status from the Services and Defense agencies; 

• re\aewing the ACOM Y2K web page for completeness and reporting 
updates to the Command, Control, Communications, and Computer Systems 
directorate; and 

• funding and replacing nonstandard commercial off-the-shelf products. 

The directorates are responsible for preparing contingency plans for 
mission-critical systems. The ACOM uses 148 systems that the Services and 
Defense agencies own. Each system has an office of primary responsibility, the 
responsible directorate that has the mission that the system supports. The office of 
primary responsibility prepares contingency plans for mission-critical systems and, 
as stated, coordinates to determine the status of those systems. 


ACOM Supporting Systems 

The ACOM did not have visibility over mission-critical supporting systems, which 
are owned by the Services and Defense agencies, because at the time of the audit 
ACOM had not established or been provided a method for monitoring and tracking 
its supporting systems. The ACOM is, necessarily, relying on the Services and 
Defense agencies to make the Y2K corrections in a timely matmer. The ACOM 
directorates are required to develop contingency plans for those systems that are 
not compliant by December 31,1998. 

The ACOM considered 53 of its 148 systems to be critical to its mission. Of the 
53 systems, ACOM did not know the status of Y2K compliance for 30 systems, 

15 systems were not Y2K compliant, and 8 systems were Y2K compliant. 

Until January 1998, the ACOM Y2K program office monitored the status of 
supporting systems using the Defense Information Support Tools database. The 
ACOM Y2K program office posted the information on the ACOM Y2K wd) page. 
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Status of the U.S. Atlantic Command Year 2000 Program 


making the information available to the offices of primary responsibility. The 
Defense Information Support Tools database is no longer available for obtaining 
information concerning the status of systems, and ACOM has not established or 
been provided alternate procedures for determining the status of those systems. 

As a result, ACOM is unable to determine the potential impact that supporting 
systems may have on its mission and any Y2K system schedule delays. 

As stated, ACOM made each directorate responsible for coordinating with its Joint 
Staff functional counterpart to monitor the status of its systems. Also, the 
directorates should join with other unified command functional counterparts to 
obtain system Y2K status information from the Services and Defense agencies. 

The directorates should report the progress of the executive agents to the ACOM 
Y2K office, noting especMy whether the systems will be compliant and fully 
implemented by December 31, 1998. The ACOM is in the process of 
implementing status-tracking requirements. 

The Office of the Assistant Secretary of Defense (Command, Control, 
Communications, and Intelligence) has developed a DoD Y2K database. In a 
recent undated memo, the DoD Y2K Oversight and Contingency Planmng Office 
decided to post the database to the Office of the Assistant Secretary of Defense 
(Command, Control, Communications, and Intelligence) web page. 

To provide further assistance to the warfij^ting community on determining the 
Y2K status of supporting systems, the Joint Staff has taken initiatives to 
compensate for the continuing problems in making that information available 
through other channels. To date, the Joint Staff has posted an extract of the DoD 
Y2K database on the SIPRNET. 


ACOM-Managed Systems 

The ACOM overall system inventory list did not accurately reflect the status of 
ACOM systems. However, as a result of this audit, the ACOM directorates are in 
the process of reconciling the directorate inventory lists to the ACOM overall 
inventory list. Additionally, ACOM is establishing ACOM directorate reporting 
requirements to the ACOM Y2K program office. As a result of the established 
requirements, ACOM consolidated reporting should provide an accurate 
assessment of the status of ACOM-managed systems. 

Quarterly Report. In the April 1998 quarterly report, ACOM reported to the 
Joint Staff that it manages 32 systems, none critical to the mission of ACOM. Of 
the 32 systems, ACOM reported 19 systems compliant, 8 systems being replaced, 
3 systems in renovation, and 2 systems to be eliminated. 

ACOM Reportable Systems. Based on our review of the ACOM 
documentation, ACOM should have reported 57 managed systems; 8 of the 
57 systems were considered critical to the mission of ACOM. Further, ACOM 
should have reported only nine systems as compliant. 
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Number of Managed Systems. Of the 32 managed systems, ACOM 
should have reported only 23 systems. One directorate was shown as having 
10 managed systems. However, eight of those systems were subsystems, were not 
systems, or did not belong to the directorate. Another system was not listed by the 
attributed directorate. In addition to the 23 reportable systems, another 
34 systems were not included in the ACOM systems inventory list, bringing the 
total reportable systems to 57. The following table provides a categorization of 
the number of systems that ACOM reported compared with the actual reportable 
systems. 

ACOM-Managed Systems 



Reported 

Actual 

Compliant 

19 

9 

To be replaced 

8 

24 

To be renovated 

3 

2 

To be eliminated 

2 

11 

To be validated 

0 

10 

Requirement to be revalidated 

_0 

_1 

Total ACOM-managed systems 

32 

57 


The ACOM is taking action to clearly establish guidelines on what is considered to 
be a reportable system and how reportable systems should be categorized and then 
to reconcile the ACOM ^sterns inventory list. The ACOM stated that an updated 
inventory would be provided to the Joint Staff in the July 1998 quarterly report. 
The ACOM needs to complete the reconciliation of its inventory lists and to define 
reportable systems. 

Mission-Critical Systems. The ACOM should have reported that it 
manages eight mission-critical systems. Two of the mission-critical systems are 
not expected to be compliant until after December 31, 1998, the deadline for 
implementing all mission-critical systems. 


Certification and Compliant Checklists 


The ACOM did not complete compliance certification checklists for eight of the 
nine ACOM-maiu^ed systems stated to be Y2K compliant. As stated earlier in 
this report, ACOM had reported that it had 19 managed systems that are Y2K 
compliant. However, the following 10 systems should not have been included; 

• 8 systems that were not reportable systems, 

• 1 system that is not scheduled to be renovated until October 1998, and 

• 1 system that was not compliant. 
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The DoD Management Plan states that systems developers and maintainers, along 
with the system’s functioned proponent, will certify and document each system’s 
Y2K compliance. The DoD Y2K Management Plan and ACOM Draft Y2K 
Management Plan provide a sample Y2K compliance checklist. 

For seven of the nine systems, ACOM had some supporting documentation to 
show that Y2K tests had been done and no problems identified. For two of the 
nine systems, Y2K compliance is based on verbal information with no 
documentation to support it. Inspector General, DoD, Report No. 98-147, 

“Year 2000 Certification of Mission-Critical DoD Information Technology 
Systems,” June 5, 1998, estimated that DoD Components certified only 25 percent 
of the systems reported as compliant. As a result, systems may unei^ectedly fail 
because they were classified as Y2K compliant without adequate verification and 
validation. 

Although existing documentation and verbal information are some basis on which 
to support Y2K compliance, ACOM directorates need to complete compliance 
certification checklists to fiilly support those systems as Y2K compliant. Further, 
compliance certification checklists will provide uniformity and continuity for 
ACOM-managed systems and a record of testing performed for successive system 
maintainers. 


Commercial Off-the-Shelf Products 

The ACOM did not establish the office of primary responsibility for 
104 commercial off-the-shelf products as of April 14, 1998. Commercial 
off-the-shelf products refer to software that a contractor has produced and that is 
available for general purchase. In addition, ACOM has not determined Y2K 
compliance for 128 of the 361 commercial off-the-shelf products supported by the 
directorates and sub-commands. Of the 128 applications for which compliance is 
unknown, 71 applications are without an office of primary responsibility. 

The ACOM commercial off-the-shelf inventory list appears to have discrepancies 
as to compliance of Y2K applications. For several applications, directorates are 
reporting different results about the Y2K compliance of the same application. The 
discrepancies appear to be the result of lack of coordination between the 
directorates and sub-commands and the Y2K program office. The ACOM is 
taking action to determine the compliance of its commercial off-the-shelf inventory 
list and to reconcile the discrepancies. The ACOM needs to complete those 
actions. 


Contingency Plans 

As a result of this audit, ACOM has documented in the ACOM Y2K Management 
Plan its strategy for the development, implementation, and timefi’ames for 
contingency planning. The management plan requires that ACOM develop 
contingency plans by December 31, 1998, for mission-critical systems not 
compliant by that date. Although ACOM had a written strategy for contingency 
planning, ACOM had not developed contingency plans for mission-critical 
systems. On May 29, 1998, the ACOM Y2K program office notified the 
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directorate Y2K focal points that the offices of primary responsibility are required 
to contact the executive agents and request a copy of die compliance certification 
checklist for the mission-critical systems and obtain installation delivery dates for 
systems that are not compliant yet. Additionally, the offices of primary 
responsibility are encouraged to request contingent^ plans fi’om the executive 
agents for those systems ffiat they know will not be compliant by 
December 31,1998. 

The Joint Chiefs of Staff Year 2000 Action Plan requires that the imified 
commands conduct sufficient planning and establish alternate procedures to 
successfully complete their mission while system program managers and technical 
staff make necessary Y2K corrections. Alternate procedures must be applicable to 
day-to-day peacetime operations as well as waifig^ting and peacekeeping 
operations. The ACOM must monitor both the status of its mission-critical 
systems and the completion schedules when developing contingency plans. The 
ACOM directorates need to begin coordinating with the Joint Staff, file Services, 
and the unified commands to determine realistic completion schedules for the 
common mission-critical systems and develop both system and operational 
contingency plans to establish alternate procedures to accomplish their missions. 


Command and Joint Exercises 


Because of time constraints posed by Y2K issues, using selected command and 
joint exercises to test Y2K scenarios may assist ACOM in making further progress 
to identify and resolve Y2K problems, ffispector General, DoD, 

Report No. 98-173, “U.S. Central Command Year 2000 Issues,” July 2,1998, and 
Inspector General, DoD, Report 98-129, “U.S. Special Operations Command 
Year 2000 Issues,” May 8, 1998, recommended that the Joint Staff integrate 
year 2000 scenarios into operational requirements in joint exercises in FY 1998 for 
the purposes of determining the extent of potential Y2K impact on the continuity 
of the warfighter. The U.S. Central Command and the U.S. Special Operations 
Command concurred with the recommendation. 

The House bill to authorize appropriations for FY 1999 for the Department of 
Defense, H. R. 3616, proposes that the Secretary of Defense submit to Confess a 
report containing a plan to include simulated Y2K scenarios in military exercises 
conducted from January 1 through September 30,1999. The plan is to include 
military exerdses conducted under the Chairman of the Joint Chiefs of Staff 
Exerdse Program. Additionally, the plan is to cover ^sterns excluded fi'om the 
exercise and an explanation of how the military exercise will use an excluded 
system’s Y2K contingency plan. The Senate version of H.R. 3616 proposes that 
the Secretary of Defense and the Director of Central Intelligence jointly submit to 
Congress a report on the plans of the DoD and intelligence community for 
ensuring the continuity of performance of essential operations that are at risk of 
failure because of computer systems and other information and support systems 
that are not Y2K compliant. The report shall be submitted not later than 
March 31, 1999. The House and Senate versions of H.R. 3616 are under 
consideration by the conferees to the DoD authorization conference, who are 
considering the FY 1999 DoD bill. 
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The Secretary of Defense has tasked the Chairman of the Joint Chiefs of Staff to 
develop a Joint Y2K operational evaluation program and to provide the plans by 
October 1, 1998. In June 1998, the Vice Chairman, Joint Chiefs of Staff, sent a 
message to the unified commands. Services, and Defense agencies. The message 
provided a ^opsis of the operational evaluation plan, solicited unified command 
involvement in the Y2K process, and requested feedback on Y2K operational 
evduation opportunities. The Y2K operational evaluation plan will encourage use 
of joint exercises, demonstrations, mission readiness assessments, tests, or other 
opportunities for evaluation of readiness. The goal of Y2K operational evaluations 
is to assure the warfighters that their key mission-critical systems will not fail 
because of Y2K perturbations, as isolated systems, or as part of the interconnected 
systems environment in which warfighting as peacekeeping missions are 
conducted. 

Performing coi^and md joint exercises to test Y2K interoperability of system 
interdependencies and interfaces may not be possible in some instances if the 
Services and Defense agencies have not made and implemented the necessary Y2K 
corre^ons to the required systems. However, in an effort to mitigate the risk 
associated with the Y2K issue and the effect that Y2K could have on the core 
mission of ACOM, testing contingent plans in an operational environment will be 
required. Testing contingency plans is vital to help ACOM assess its capability to 
continue operations if systems fail because of Y2K problems. 


Conclusion 

The ACOM, like the other unified commands, must take an aggressive approach to 
dealing with Y2K for supporting ^sterns to ensure that it is well-positioned to deal 
with unexpected problems and delays. The ACOM must continually monitor and 
assess the progress of supporting systems so that it may forecast potentid 
Y2K disruptions to the ACOM mission and prepare operational contingency plans 
accordingly. We recognize the inherent problems coi^onting ACOM and other 
system users, who must rely on system owners to cany out the necessary 
remediation measures. The Military Departments and Defense agencies must make 
accurate information on Y2K risk and remediation status available to the Joint 
Staff and unified conunands. Access to the information located on the DoD Y2K 
database would greatly facilitate the ability of ACOM and other unified commands 
to monitor the progress of their supporting systems, prepare contingency plans for 
their mission areas, and plan operational evaluations. 
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Recommendations for Corrective Action 

We recommend that the Commander in Chief, U.S. Atlantic Command: 

1. Establish procedures and timeframes for the offices of primary 
responsibility to: 

(a) Monitor and track the status of mission-critical systems 
that the Services and Defense agencies own. 

(b) Join with functional counterparts at other unified 
commands to obtain the status of mission-critical systems from the Services 
and Defense agencies. 

(c) Report the status of those systems to the year 2000 
program ofHce. 

2. Complete reconciliation of the managed-systems inventory to 
reflect the actual number and status of the U.S. Atlantic Command systems 
and cleariy define reportable systems and how reportable systems should be 
categorized. 

3. Complete compliance certification checklists to fully support 
systems as year 2000 compliant. 

4. Establish offlces of primary responsibility for nonstandard 
commercial off-the-shelf products and complete reconciliation of compliance 
discrepancies. 

5. Devdop system and operational contingency plans that will 
establish alternate procedures to successfully accompUsh the mission if year 
2000 disruptions occur. 

6. Use selected command and joint exercises to test year 2000 
scenarios and contingency plans in an operational environment when 
possible. 

Management Comments. The ACOM concurred with all of the 
recommendations except to join functional counterparts at the other unified 
conunands to obtain the status of mission-critical systems from the Services and 
Defense agencies. 

The ACOM stated that it has developed a database to monitor and track the status 
of mission-critical systems that the Services and Defense agencies own. The 
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Status of the U.S. Atlantic Command Year 2000 Program 


offices of primary responsibility are to report all information on supporting systems 
and commercial off-the-shelf software to the ACOM Y2K ofiice on a monthly 
basis. Additionally, ACOM stated that it; 

• completed the managed-system inventory reconciliation May 29, 1998; 

• established September 1, 1998, as the completion date for all 
certification checklists; 

• established offices of primary responsibility for all commercial 
off-the-shelf products as of June 30, 1998; and 

• established a deadline of December 31,1998, for the completion of 
contingency plans for supporting systems. 

The ACOM is providing input to the Joint Staff for the Chairman of the Joint 
Chiefs of Staff operation evaluation plan. 

The ACOM did not agree to join the functional counterparts of the other unified 
commands in obtaining status information, stating that the executive agents would 
be inundated with duplicate requests. ACOM stated that a more efficient approach 
would be for the Joint Staff to obtain the status information and provide it 
simultaneously to the unified commands. 

The Joint Staff stated that it endorses the recommendations to improve the Y2K 
posture of ACOM; however, the Joint Staff agrees with the concerns ffiat ACOM 
expressed. 

Audit Response. We consider the comments of ACOM to be responsive. We 
commend ACOM for expediting the necessary actions to address the 
recommendations of the report. 

We did not intend that the unified commands duplicate efforts to obtain the status 
of mission-critical systems fi-om the Services and Defense agencies. Rather, fire 
intent of the recommendation was to encourage a unified command-wide 
involvement fi-om a functional perspective in DoD Y2K remediation and continuity 
of operations efforts. For example, an outcome of the Y2K conference of the 
unified commands was the scheduling of the Operations (J-3) directorate Y2K 
conference to be held in September 1998 to collectively discuss continuity of 
operations issues. Other flmctional directorates of the unified commands may have 
to also proactively and collectively work together to obtain and share system 
information to support Y2K remediation and continuity of operations efforts. We 
agree, however, that a central Joint Staff role in collecting and disseminating Y2K 
status information is ^dtal. 
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Part n - Additional Information 


Appendix A. Audit Process 


This is one in a series of reports being issued by the Inspector General, DoD, in 
accordance with an informal partnership with the Chief Information OflScer, DoD, 
to monitor DoD efforts to address the Y2K computing challenge. For a listing of 
audit projects addressing the issue, see the Y2K webpage on IGnet at 
<http://www.ignet.gov>. 


Scope 


We reviewed and evaluated the status of the progress of ACOM in resolving the 
Y2K computing issue. We evaluated the Y2K efibrts of ACOM and compared 
them with those efforts described in the DoD Management Plan issued by the 
Assistant Secretary of Defense (Command, Control, Communications, and 
Intelligence) in April 1997. We obtained documentation including the ACOM 
Y2K Management Plan, the ACOM Y2K responses to the Office of the Inspector 
General, DoD, Y2K questiormaire, and systems inventory database information as 
of April 1998. We used the information to assess efforts related to the multiple 
phases of managing the Y2K problem. 

DoD-Wide Corporate-Level Government Performance and Results Act 
Goals. In response to the Government Performance and Results Act, the 
Department of Defense has established 6 DoD-wide corporate-level performance 
objectives and 14 goals for meeting the objectives. This report pertains to 
achievement of the following objectives and goals. 

• Objective: Prepare now for an uncertain future. Goal: Pursue a focused 
modernization effort that maintains U.S. qualitative superiority in key war 
fighting capabilities. (DoD-3) 

DoD Functional Area Reform Goals. Most major DoD functional areas have 
also established performance improvement reform objectives and gods. This 
report pertains to achievement of the following functional area objectives and 
goals. 

• Information Technology Management Functional Area. 

Objective: Become a mission partner. Goal: Serve mission information 
users as customers. (lTM-1.2) 

• Information Technology Management Functional Area. 

Objective: Provide services that satisfy customer information needs. 
Goal: Modernize and integrate Defense information infi’astructure. 
(ITM-2.2) 

• Information Technology Management Functional Area. 

Objective: Provide services that satisfy customer information needs. 
Goal: Upgrade technology base. (ITM-2.3) 
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Appendix A. Audit Process 


General Accounting Office High-Risk Area. In its identification of risk areas, 

■ the General Accounting Office has specificaUy designated risk in resolution of the 
Y2K problem as high. This report provides coverage of that problem and of the 
overall Information Management and Technology high-risk area. 


Methodology 

Audit Type, Dates, and Standards. We performed this economy and efficiency 
audit fi-om April through June 1998 in accordance with auditing standards issued 
by the ComptroUer General of the United States, as implemented by the Inspector 
General, DoD. We did not use computer-processed data to perform this audit. 

Contacts During the Audit. We visited or contacted individuals and 
organiz at ions within DoD. Further details are available upon request. 

Management Control Program. We did not review the manageinent control 
program related to the over^ audit objective because DoD recognized the 
Y2K issue as a material management control weakness area in the FY 1997 Annual 
Statement of Assurance. 
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Appendix B. Summary of Prior Coverage 


The General Accounting OflBce and the Inspector General, DoD, have conducted 
multiple reviews related to Y2K issues. General Accounting Office reports can be 
accessed over the Internet at http;//www.gao.gov. Inspector General, DoD, 
reports can be accessed over the Internet at http://www.dodig.osd.mil. The 
following summarizes the Y2K coverage of the unified commands. 

Inspector General, DoD, Report No. 9S>188, **U.S. Space Command 
Year 2000 Issues,” August 18,1998. The report states that the U.S. Space 
Conunand and component commands have taken actions to address the Y2K 
problem, but not completed all the actions necessaiy to minimize the adverse 
impact of Y2K date processing on its mission and its mission-critical systems. 

The report recommended that the U.S. Space Command identify Y2K as a 
readmess issue and include functional chrectorates in future warfighter Y^ 
conferences hosted by the Joint Staff. The report also recommended that the U.S. 
Space Command develop the following; 

• written Y2K management plan; 

• complete list of mission-critical systems; 

• contingency plans for mission-critical systems that U.S. Space 
Command manages; 

• operational contingency plans for mission areas; and 

• comprehensive and complete test plans. 

Additionally, the report recommended that the U.S. Space Command complete the 
idra^cation of interfaces and prepare written interface agreements for 
mission-critical systems that U.S. Space Command manages; coordinate Y2K 
solutions and contingency plans wiffi its componoit commands; and use selected 
command and joint exercises to test Y2K scenarios and contingency plans in an 
operational environment when possible. The report recommended the Joint Staff 
include all functional directorates and component commands in the warfighter 
Y2K conference. The U.S. Space Command and the Joint Staff concurred with 
the recommendations of the report. The U.S. Space Command stated t^t it has 
inifiated action to address the recommendations of the report. The Joint Staff 
stated that all functional directorates would be invited to the Joint Staffs 
August 1998 and subsequent Y2K conferences. 

Inspector General, DoD, Report No. 98-173, **U.S. Central Command 
Year 2000 Issues,” July 2,1998. The report states that the U.S. Central 
Command has taken several positive actions to address its Y2K problem. 

However, the U.S. Central Command and the Joint Staff have not completed all of 
the actions necessaiy to minimize the adverse impact of Y2K date processing in 
mission and mission-support systems. 
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AppendiiB. Summary of Prior Coverage 


The report recommended that the U.S. Central Conufiand monitor and implement 
DoD Year 2000 Management Plan revisions; complete the identification of 
mission-critical supporting ^sterns and system interfaces; research Y2K 
compliance of vendor software and test mission-critical vendor software; prepare 
written interface agreements; develop contingency plans for U.S. Central 
Command mission-critical managed and supporting systems and develop 
operational con^tingency plans as needed; document tests plans and certify the level 
of Y2K compliance for managed systems; coordinate Y2K solutions with the 
Component Commands; and use selected command and joint exercises to test Y2K 
scenarios in an operational enwronment. The U.S. Central Command concurred 
with the recommendations of the report. 

The report also recommended that the Joint Staff develop a composite 
DoD mission-critical database and assist the unified commands in obtaining Y2K 
information on mission-critical supporting systems that Services or other 
organizations manage; implement procedures to monitor and track the status of 
mission-critical supporting systems; assist the unified commands in testing systems 
and applications common to the unified commands; disseminate Y2K information 
on commercial off-the-shelf products; and use selected joint exercises to test Y2K 
scenarios in an operational environment. The Joint Staff concurred with the 
recommendations of the report. 

In an effort to provide assistance to the unified commands, the Joint Staff 
extracted data fi'om the DoD Y2K Project Office developed systems database and 
posted it to the Joint Staff Y2K web site. The database was not available on-line 
because of classification issues. The Joint Staff also stated that it has been 
facilitating the J<)int Interoperability Test Commancl for Y2K testing of systems 
owned by the unified commands. Finally, the Joint Staff stated that it is developing 
a Y2K operational evaluation plan for use by the unified conunands and the 
Services during exercises and other opportunities from now until the Year 2000. 

In June 1998, the Vice Chdrman, Joint Chiefs of Staff, sent a message to the 
unified commands. Services, and Defense agencies. The message provided a 
^opsis of the operational evaluation plan, solicited unffied command involvement 
in the Y2K process, and requested feedback on Y2K operational evduation 
opportunities. 

Inspector General, DoD, Report No. 98-129, ‘‘U.S. Special Operations 
Command Year 2000 Issuu,” May 8,1998. The report states that the progress 
that the U.S. Special Operations Command made in resolving its Y2K problem is 
not complete. To ensure that its mission-critical systems will successfully operate 
at the Y2K and b^ond, the U.S. Specnal Operations Command, including its 
component commands and functional directorates, must address several critical 
issues. Urdess the U.S. Special Operations Command makes further progress, it 
faces a high risk that year-2000-related disruptions will impair its mission 
capabilities. 

The report recommended that the U.S. Special Operations Command implement 
revisions to the DoD Year 2000 Management Plan; continue to identify U.S. 
Special Operations Command managed mission-critical systems and the associated 
interfaces and for those systems; prepare written interface agreements and 
contingency plans; continue to identify mission-critical supporting systems that 
Services or other organizations manage; refine cost estimates for each individual 
system to determine amounts needed for fund allocation; determine systems as 
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Y2K compliant only after testing the systems and completing compliance 
checklists; and use selected command and joint exercises to test Y2K scmarios in 
an operational environment. Additionally, the report recommended that the Joint 
Staff assist the unified commands in obtaining Y2K information on mission>critical 
supporting systems that Services or other organizations manage; assist the unified 
commands in testing systems and applications that are common to the unified 
commands; and use selected joint exercises to test Y2K scenarios in an operational 
environment. The U S. Special Operations Command and the Joint Staff 
concurred with the recommendations of the report, stating progress made and 
future intentions for each recommendation. 
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Appendix C. Report Distribution 


Office of the Secretary of Defense 

Under Secretary of Defense for Acquisition and Technology 
Director, Defense Logistics Studies Information Exchange 
Under Secretj^ of Defense (Comptroller) 

Deputy Chief Financial Officer 
Deputy Comptroller (Program/Budget) 

Assistant Secretary of Defense (Command, Control, Communications, and Intelligence) 
Year 2000 Oversight and Contingency Planning Office 
Assistant Secretary of Def«ise (Public Affairs) 

Joint Staff 

Director, Joint Staff 

Department of the Army 

Assistant Secretary of the Army (Financial Management and Comptroller) 

Auditor General, Department of the Army 
Chief Information Officer, Army 

Department of the Navy 

Assistant Secretary of the Navy (Financial Management and Comptroller) 

Auditor General, Department of the Navy 
Chief Information Officer, Navy 

Department of the Air Force 

Assistant Secretary of the Air Force (Financial Management and Comptroller) 

Auditor General, Department of the Air Force 
Chief Information Officer, Air Force 

Unified Commands 


Commander in Chief, U S. European Command 
Commander in Chief, U.S. Pacific Command 
Commander in Chief, U.S. Atlantic Command 
Commander in Chief, U.S. Southern Command 
Commander in Chief, U.S. Central Command 
Commander in Chief, U.S. Space Command 
Commander in Chief, U.S. Special Operations Command 
Commander in Cluef, U.S. Transportation Command 
Commander in Chief, U.S. Strategic Command 
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Other Defense Organizations 


Director, Defense Contract Audit Agency 
Director, Defense Information Systems Agency 

Inspector General, Defense Iiiformation Systems Agency 
Chief Information Officer, Defense Information Systems Agency 
United Kingdom Liaison Officer, Defense Information Systems Agency 
Director, Defense Logistics Agency 
Director, National Security Agency 

Inspector General, Nationd Security Agency 
Inspector General, Defense Intelligence Agency 

Non-Defense Federal Organizations and Individuals 

Chief Information Officer, General Services Administration 
Office of Management and Budget 

Office of Information and Regulatory ^airs 
Federal Cluef Information Officers Council 

Technical Information Center, National Security and International Affairs Division, 

General Accounting Office 

Director, Defense Information and Financial Management Systems, Accounting and 
Information Management Division, General Accounting Office 

Chairman and ranking nunority member of each of the following congressional committees 
and subcommittees: 

Senate Special Committee on the Year 2000 Technology Problem 
Senate Committee on Appropriations 

Senate Subcommittee on Defense, Committee on Appropriations 
Senate Committee on Aimed Services 
Senate Committee on Governmental Affairs 
House Committee on Appropriations 

House Subcommittee on National Security, Committee on Appropriations 
House Committee on Governmental Reform and Oversight 
House Subcoroinittee on Government Management, Information, and Technology, 
Committee on Government Reform and Oversight 
House Subcommittee on National Security, International Affairs, and Criminal Justice, 
Committee on Government Reform and Oversight 
House Conunittee on National Security 
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U.S. Atlantic Command Comments 



l»»AmilBfr CNF OEFeME 


7000 

SerK)01<}4m;9736 
16 My 1998 


MUMOKANDUM FOR: Tn^)ector General, Oepartmemof Defense 

Subject: AuditReport on U.S. Adantic Command Year 2000 Issues 
(Pnijeci No. 8AS-0006.03) 

I. Tlwj subject draft report has been reviewed iiKi comments are forwarded as requested as 

Attachment 


RO^DN.BRAUNH 
Colonel, Air Force 
lospector General 
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U.S. Atlantic Command Comments 


Final Report 
Reference 



DEPARTMENT OF DEFENSE 

COMMAWOmiiCMgF 
ULft. ATLANHC COMMANP 

iscimcicil AMBMIE $um»o 


•tMVUTM 

J631B 

SerSU/ 


memorandum FOR: Inspector Oeoenl, Dqwttmeot of Defdise 

Subject: AudUt Report on U.S. Atlantic ConauadYetr 2000 Ifs^ 

CommenU on ftportpiovided in icfacBoe (a) lie submitted as leqoested. Ourprimaty 
coflKcm is ibe lack efvisxliUiiyom die stanssof^jmDupiovidedt^ other ageac^ USACOM 
supports the OSD initiative to cMte a centeal database to provide status data to all tbeClNCs 
and to reduce diqiUcaiioo of cflEbft AvailabUityofacrortal database ii long overdue, his 
inqioativc that one is made available now. 

Z SpedEc comments: 

a. Faee5,firstpangrapb. Delete **AOOM did not adequately acoompUdi the 
following:^ R^lace with **actions aee still on^'toins intfae (bUowing areas:** 

Rationale : Accuracy. 

b. Page 7, ACOMSuppocting Systems: Append **(Odier Agency DevdopedSystemsr 

to (he paragraph heading, 

Ratiofwdc : Consistency. Systemsprovxdedto ACOMbyotherageneseshavebeen 
rqxicted and documented as Other Agency Developed vice Supporting Systems. AUsoftwaiets 
use. mcludtng ACOM-developed is considered supporting. 

c. PageT^fimseoteace. Recormneadddete: **supporting systems.** and **beetuse 
ACOM has not established a method for mooHoring and tradaag its supportiog systems.** 


Aecuncy. ACOM had been ttaddog other agency systems via the DIST 
daUbasewtlU it wm taken ofr-4tne in January 9d. AUmformationcolleciBd was potted on the 
ACOM Y2R homepage to provide feedbadL to all AGOMtisen. The Joint Staff promised 
inuninent aceess to a new database tor all CTKCs St the Joint Staff confeeiice m Maroh. 1991. 
From the outset, the Joint Staff was the dmignaied fcpresentitive firr the CDSfCs widi all Serdoe 
and Executive ^ents to preclude die need fix and reduce die fedondan^ of each QNC 
contacting every agency indqiendeatly. The goal was to also eUmm atc the re quii e m cnt for each 
agency to provide the same i^oonafion to every CINC. 

d. Page 7. third paragraph. rtxdiUito. Reoommeod change **ACOM" to **Joutt Staff.*' 


Revised 


Page 6 


Paged 
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U.S. Atlantic Command Comments 


■inal Report 
Reference 


Page 8 


Pages 


Sutjcct: AuditKq)ortonU.S.Atl»dcComniand Year2000 Issues 

Rationale; Accuncy. The ToUil Staff ts cesponsiblcfbr establUhiag altetnate pcoccdores 
for pcovidins ^ status infoonation to all ClNCs and indicated ihxs at the Mot Staff oonfcrBice 
m March 1998. 

Issues 

e. Page 9, first pasagtaph. R c co g nm e o d diaage **eigy mbaaott oitScal syitcma to **two ” 
Delete eutiie second sentence. 

Rationrie: Acciaaey. JZsysteois, tMbxdiiimdestgBaedascriitiedtot^ 
latellieeocc Co mm and, had not hem coead ina ted as ACOM nussxon crfticaL Subsequent 
discussions decennined ^ of thecig]itwecenoCinuaoa critical to ACOM. 

L Page 9, under Ootifiettion and ConqdiantCheeklistSyCeplaee the first tfasee sentences 
\rith**ACOM has lud completed coctqdisDoeccriificatio&ritecklists far any of die ACOM- 
maoaged systems stated to he Y2K compliant** 

Ratiopale: Aceuticy and clarity. 

3. Comments on recommendations, page 12: 

a. We concur that timDiiectocatmritould monitor and track dm status of mission critical 
sysUuns aikL report die status of those systems to the Y2K program office; however, we ntm* 
concur (hat the Directorates should join until functional oounterpitts at ote unified eommatids 
m obtain the status of misston critical systems from the Services and Detese agencies. 

Rationale: ifench unified comm a nd i nde p endently ceaiticts the Services and Defense 
agencies to ohtaiastmus, timexecistivcagentttrifl be inundarodudih duplicate requests. Amore 
effident approach is Ibr the loint StaSTio ohtrin the status and pronmlgate tile infimnation 
aunititaneottsty m att tim imified oomntands. 

Coneetive actions talcen: (1) ACOM Y2K office has developed a database In 
ACCESS to contain the infermationbcttgaou^ (2) DimeaoiatMrqwit all OOTS and COTS 
infonnationloltiSNLTtheSthoffach month, f&frxaationu provided m the Jotm 
IStfaofcachoottdL 

b. We coQgurvritiitimreconcfltttionoftimnuuiigicd-systiems inventory to 
actual number and status of ACOM systems. 

Conectt^ fctieo taken : Reconciliation was completed on 29 May 1998 altihougb 
new systems cootiisue to be added. 

c. We concur with the reomremeat for oonmliance certification dwcIrlistK 
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U.S. Atlantic Command Comments 


Subject; AuditR^<>rtonU.S.AtltttkCosiiDaiid Year 2000 lesues 


ccrtificstioo chcdduts. 


q: 1 Sep 91 tJ theeaebHshM dite for ooc^letioti of all 


d. We concur wlfo estaHlAing offiect ofpdmity ityonsib^ IbrnoQ^itandard 
cocm»diloff<lic-aiidtf^products«adconq>!rtingiccon^ialionofcoii^!taacedi^^ 

Subject: Audit Report co U. S. Atlantic Comoi^ 

Coppeetive action taken: OPRi have been crtahliahrd far ill COTS as of 30 lime 


e. Wecoococwfodevelopingqratemafidopecatioaalcaitiafenqrpieu 
alternate piocediscs to euecettfolly MOQQiplIdifos lauiioii if year2000 diinvcloaa occur. 

Cowectyvcactioft taken : 31 Dec 1991 is tbeAOOMeshblubed deadline for 
eompkdtmofcocitmeeacypl^ for all GOTS; this data is aoieiggnamtbaa the OSD 


£ We concur with testmg year2000 scenarios and cootiasencyplaiufo an c^ieiatto 
eavxronmait. 

Coneettve action taken : A i c co niiBcn d ed plan is being aribmitted to the Joint 
Staffpertbrir request By24 July 1991 die Joint Staff will develop an opeauioealevaliilatioa 
plan; AOOM wQl particqMteas requirecL 

4. PoistofooneutisKfos.rwylaL.PeaaoivJd31B»DSNt36-7710. 


JORNP.CAVANAU^ V 
g Biiga&r GMeal»\J. 5. Aany 


Biiga&r GMeal»\J. 5. Aany 
DiiaeCDr for Coonttad 

•ad Goapater Systeas 


Rcfeicooes: 

(a) DnftIX>DIGAtt£tlUiK»tPi9MNo >A$4K)0&<OefJ<aelt,199S 
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Joint Staff Comments 


THE JOlirr STAFF 

WMHWQTON, DC 


Repfy ZIP Code: DJSM 803-98 

20318-0300 24 July 1998 


MEMORANDUM FOR IHB INSPECTOR GENERAL. DEPARTMENT OF DEFENSE 

Subject Audit Report on US Atlantic Command Year 2000 Issues (Prefect No. 8AS- 
0006.03) 


1. Tlie Joint Staff endorses your suggestions to improve the year 2000 posture of the 
US Adaxitlc Command (USACOM).^ We are committed to ensuring the warfighting 
missions of the combatant commands are conducted without year 2000-related 
mission degradation. 

2. Ihe draft audit report Included findings for USACOM. Ihe Joint Staff concura in 
concerns express^ in USACOM*s management comments, «^ch are shown at the 
Enclosure. 

3. The Joint Staff point of contact for year 2000 actions is Lieutenant Colond 
Lucinda Hackman. J-6, (703) 697-1207, DSN 227-1207, lucinda^hackmanOys. 
pentagon.mll. 


DENNIS C. BLAIR 
Vice Admiral. U.S. Navy 
Director, Joint Staff 


Enclosure 

Reference: 

1 DOD/IG memorandum, 18 June 1998, "Audit Report on U.S. Adanbc 
Command Year 2000 issues (Project No. 6AS-0006.03)" 


Enclosure omitted because it repeats comments that the U.S. Atlantic Command made. 
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